Skip to content
Heist/ feed
High

tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). Anderson Nascimento reported a use-after-free splat in tcp_twsk_unique() with nice analysis. Since commit ec94c2696f0b ("tcp/dccp: avoid one atomic operation for timewait hashdance"), inet_twsk_hashdance() sets TIME-WAIT socket's sk_refcnt after putting it into ehash and releasing the bucket lock. Thus, there is a small race window where other threads could try to reuse the port during connect() and call sock_hold() in tcp_twsk_unique() for the TIME-WAIT socket with zero refcnt. If that happens, the refcnt taken by tcp_twsk_unique() is overwritten and sock_put() will cause underflow, triggering a real use-after-free somewhere else. To avoid the use-after-free, we need to use refcount_inc_not_zero() in tcp_twsk_unique() and give up on reusing the port if it returns false. [0]: refcount_t: addition on 0; use-after-free. WARNING: CPU: 0 PID: 1039313 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110 CPU: 0 PID: 1039313 Comm: trigger Not tainted 6.8.6-200.fc39.x86_64 #1 Hardware name: VMware, Inc. VMware20,1/440BX Desktop Reference Platform, BIOS VMW201.00V.21805430.B64.2305221830 05/22/2023 RIP: 0010:refcount_warn_saturate+0xe5/0x110 Code: 42 8e ff 0f 0b c3 cc cc cc cc 80 3d aa 13 ea 01 00 0f 85 5e ff ff ff 48 c7 c7 f8 8e b7 82 c6 05 96 13 ea 01 01 e8 7b 42 8e ff <0f> 0b c3 cc cc cc cc 48 c7 c7 50 8f b7 82 c6 05 7a 13 ea 01 01 e8 RSP: 0018:ffffc90006b43b

Announced Source revision 1
Original source ↗

CVE-2024-36904

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2024-36904

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
        "lessThan": "84546cc1aeeb4df3e444b18a4293c9823f974be9",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
        "lessThan": "1796ca9c6f5bd50554214053af5f47d112818ee3",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
        "lessThan": "1d9cf07810c30ef7948879567d10fd1f01121d34",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
        "lessThan": "27b0284d8be182a81feb65581ab6a724dfd596e8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
        "lessThan": "13ed7cdf079686ccd3618335205700c03f6fb446",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
        "lessThan": "6e48faad92be13166184d21506e4e54c79c13adc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
        "lessThan": "517e32ea0a8c72202d0d8aa8df50a7cd3d6fdefc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "ec94c2696f0bcd5ae92a553244e4ac30d2171a2d",
        "lessThan": "f2db7230f73a80dbb179deab78f88a7947f0ab7e",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/ipv4/tcp_ipv4.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.16"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.16",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "4.19.314",
        "versionType": "semver",
        "lessThanOrEqual": "4.19.*"
      },
      {
        "status": "unaffected",
        "version": "5.4.276",
        "versionType": "semver",
        "lessThanOrEqual": "5.4.*"
      },
      {
        "status": "unaffected",
        "version": "5.10.217",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.159",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.91",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.31",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.8.10",
        "versionType": "semver",
        "lessThanOrEqual": "6.8.*"
      },
      {
        "status": "unaffected",
        "version": "6.9",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/ipv4/tcp_ipv4.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2024-36904

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#26588 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement